rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fixes

Browse Source
This commit is contained in:
Chris PeBenito 2005-10-25 02:51:07 +00:00
parent 28e730b8e2
commit 60789e16d0
5 changed files with 41 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
refpolicy/policy/modules/kernel/devices.if
View File

@ -1917,6 +1917,22 @@ interface(`dev_mount_usbfs',`
allow $1 usbfs_t:filesystem mount; allow $1 usbfs_t:filesystem mount;
') ')
########################################
## <summary>
## Mount a usbfs filesystem.
## </summary>
## <param name="domain">
## The type of the process performing this action.
## </param>
#
interface(`dev_associate_usbfs',`
gen_require(`
type usbfs_t;
')
allow $1 usbfs_t:filesystem associate;
')
######################################## ########################################
## <summary> ## <summary>
## Get the attributes of a directory in the usb filesystem. ## Get the attributes of a directory in the usb filesystem.

2
refpolicy/policy/modules/services/mta.if
View File

@ -562,7 +562,7 @@ interface(`mta_manage_queue',`
# cjp: added for postfix # cjp: added for postfix
interface(`mta_read_sendmail_bin',` interface(`mta_read_sendmail_bin',`
gen_require(` gen_require(`
type sendmail_exec_t;; type sendmail_exec_t;
') ')
allow $1 sendmail_exec_t:file r_file_perms; allow $1 sendmail_exec_t:file r_file_perms;

2
refpolicy/policy/modules/services/mta.te
View File

@ -172,7 +172,7 @@ optional_policy(`postfix.te',`
allow system_mail_t etc_aliases_t:lnk_file create_lnk_perms; allow system_mail_t etc_aliases_t:lnk_file create_lnk_perms;
allow system_mail_t etc_aliases_t:sock_file create_file_perms; allow system_mail_t etc_aliases_t:sock_file create_file_perms;
allow system_mail_t etc_aliases_t:fifo_file create_file_perms; allow system_mail_t etc_aliases_t:fifo_file create_file_perms;
files_create_etc_config(sysadm_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file }) files_create_etc_config(system_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file })
optional_policy(`crond.te',` optional_policy(`crond.te',`
cron_crw_tcp_socket(system_mail_t) cron_crw_tcp_socket(system_mail_t)

2
refpolicy/policy/modules/services/nis.te
View File

@ -44,6 +44,7 @@ allow ypbind_t self:netlink_route_socket r_netlink_socket_perms;
allow ypbind_t self:tcp_socket { listen accept }; allow ypbind_t self:tcp_socket { listen accept };
allow ypbind_t self:tcp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown }; allow ypbind_t self:tcp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown };
allow ypbind_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown }; allow ypbind_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown };
allow ypserv_t self:udp_socket { ioctl read write create getattr setattr append bind getopt setopt shutdown connect };
allow ypbind_t ypbind_tmp_t:dir create_dir_perms; allow ypbind_t ypbind_tmp_t:dir create_dir_perms;
allow ypbind_t ypbind_tmp_t:file create_file_perms; allow ypbind_t ypbind_tmp_t:file create_file_perms;
@ -154,6 +155,7 @@ allow ypserv_t ypserv_tmp_t:dir create_dir_perms;
allow ypserv_t ypserv_tmp_t:file create_file_perms; allow ypserv_t ypserv_tmp_t:file create_file_perms;
files_create_tmp_files(ypserv_t, ypserv_tmp_t, { file dir }) files_create_tmp_files(ypserv_t, ypserv_tmp_t, { file dir })
allow ypserv_t ypserv_var_run_t:dir { ioctl read write getattr lock add_name remove_name search };
allow ypserv_t ypserv_var_run_t:file { getattr create read write append setattr unlink }; allow ypserv_t ypserv_var_run_t:file { getattr create read write append setattr unlink };
files_create_pid(ypserv_t,ypserv_var_run_t) files_create_pid(ypserv_t,ypserv_var_run_t)

22
refpolicy/policy/modules/services/zebra.te
View File

@ -30,11 +30,13 @@ files_pid_file(zebra_var_run_t)
allow zebra_t self:capability { setgid setuid net_admin net_raw }; allow zebra_t self:capability { setgid setuid net_admin net_raw };
dontaudit zebra_t self:capability sys_tty_config; dontaudit zebra_t self:capability sys_tty_config;
allow zebra_t self:process setcap; allow zebra_t self:process setcap;
allow zebra_t self:file { ioctl read write getattr lock append };
allow zebra_t self:unix_dgram_socket create_socket_perms; allow zebra_t self:unix_dgram_socket create_socket_perms;
allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms }; allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow zebra_t self:netlink_route_socket r_netlink_socket_perms; allow zebra_t self:netlink_route_socket r_netlink_socket_perms;
allow zebra_t self:tcp_socket create_stream_socket_perms; allow zebra_t self:tcp_socket create_stream_socket_perms;
allow zebra_t self:rawip_socket create_socket_perms; allow zebra_t self:rawip_socket create_socket_perms;
allow zebra_t self:capability net_bind_service;
allow zebra_t zebra_conf_t:dir r_dir_perms; allow zebra_t zebra_conf_t:dir r_dir_perms;
allow zebra_t zebra_conf_t:file r_file_perms; allow zebra_t zebra_conf_t:file r_file_perms;
@ -50,10 +52,11 @@ allow zebra_t zebra_tmp_t:sock_file create_file_perms;
files_create_tmp_files(zebra_t,zebra_tmp_t,sock_file) files_create_tmp_files(zebra_t,zebra_tmp_t,sock_file)
allow zebra_t zebra_var_run_t:file create_file_perms; allow zebra_t zebra_var_run_t:file create_file_perms;
files_create_pid(zebra_t,zebra_var_run_t) files_create_pid(zebra_t,zebra_var_run_t, { file sock_file })
kernel_read_system_state(zebra_t) kernel_read_system_state(zebra_t)
kernel_read_kernel_sysctl(zebra_t) kernel_read_kernel_sysctl(zebra_t)
kernel_tcp_recvfrom(zebra_t)
kernel_rw_net_sysctl(zebra_t) kernel_rw_net_sysctl(zebra_t)
corenet_tcp_sendrecv_all_if(zebra_t) corenet_tcp_sendrecv_all_if(zebra_t)
@ -67,16 +70,24 @@ corenet_udp_sendrecv_all_ports(zebra_t)
corenet_tcp_bind_all_nodes(zebra_t) corenet_tcp_bind_all_nodes(zebra_t)
corenet_udp_bind_all_nodes(zebra_t) corenet_udp_bind_all_nodes(zebra_t)
corenet_tcp_bind_zebra_port(zebra_t) corenet_tcp_bind_zebra_port(zebra_t)
corenet_tcp_bind_all_reserved_ports(zebra_t)
corenet_tcp_connect_all_reserved_ports(zebra_t)
dev_associate_usbfs(zebra_var_run_t)
dev_list_all_dev_nodes(zebra_t)
dev_read_sysfs(zebra_t) dev_read_sysfs(zebra_t)
dev_read_sysfs(zebra_tmp_t)
dev_rw_zero_dev(zebra_t)
fs_getattr_all_fs(zebra_t) fs_getattr_all_fs(zebra_t)
fs_search_auto_mountpoints(zebra_t) fs_search_auto_mountpoints(zebra_t)
term_dontaudit_use_console(zebra_t) term_dontaudit_use_console(zebra_t)
term_list_ptys(zebra_t)
domain_use_wide_inherit_fd(zebra_t) domain_use_wide_inherit_fd(zebra_t)
files_search_etc(zebra_t)
files_read_etc_files(zebra_t) files_read_etc_files(zebra_t)
files_read_etc_runtime_files(zebra_t) files_read_etc_runtime_files(zebra_t)
@ -99,12 +110,21 @@ ifdef(`targeted_policy', `
term_dontaudit_use_unallocated_tty(zebra_t) term_dontaudit_use_unallocated_tty(zebra_t)
term_dontaudit_use_generic_pty(zebra_t) term_dontaudit_use_generic_pty(zebra_t)
files_dontaudit_read_root_file(zebra_t) files_dontaudit_read_root_file(zebra_t)
unconfined_sigchld(zebra_t)
')
optional_policy(`ldap.te',`
ldap_use(zebra_t)
') ')
optional_policy(`nis.te',` optional_policy(`nis.te',`
nis_use_ypbind(zebra_t) nis_use_ypbind(zebra_t)
') ')
optional_policy(`zebra.te',`
rpm_read_pipe(zebra_t)
')
optional_policy(`selinuxutil.te',` optional_policy(`selinuxutil.te',`
seutil_sigchld_newrole(zebra_t) seutil_sigchld_newrole(zebra_t)
') ')